3 ms·
There is no way to know or verify what is or isn't a real leak, and what passwords are or aren't leaked. We can't settle this in the comments, and I think it's
by pompino 3y ago
There is no way to know or verify what is or isn't a real leak, and what passwords are or aren't leaked. We can't settle this in the comments, and I think it's just security theater.
1. User x signs up for Service A using pwd abcd1234
2. User y signs up for Service B using pwd abcd1234
2. User z signs up for Service C using pwd abcd1234
Service A is breached. Users x,y,z get emails forcing a reset of their password. Users x,y,z reset their password to abcd1245 and all is good (among many other permutations). Now Service B is breached, rinse and repeat.
Depending on the workflow (the more automated it is the worse off we are), there are security vectors to exploit here by doing a carefully planned fake 'leak' using mostly useless emails but only a few genuine emails to trigger pw resets, etc, etc.
- g-b-r 3y agoI'm not sure what you're talking about, you definitely seem to have misconceptions about passwords, their math and services like haveibeenpwned. You seem to like simple passwords and think that people should use them so long as they're not leaked. Well no, simple passwords are never good; a probably very large number of the possible ones has already been the subject of some leak, and they're very risky in any case. Service providers (should) strive to give some protections even to users with bad passwords, but you sure can't rely on that.
- pompino 3y agoIts easy to lose track of these complex topics. Anyway another day, another time maybe I can explain it better to you.